Composer Update

Composer Update

Purpose

Analyze dependency updates after composer update, detect conflicts, and summarize relevant changes.

Constraints

• Apply @rules/php/core-standards.mdc
• Apply @rules/php/dependency-selection.mdc — this skill primarily bumps existing packages (rule out of scope per its Scope section), but a bump frequently uncovers an upstream that has been archived or marked abandoned. When that happens, re-run the Activity gate + Compatibility gate against the suggested replacement (or against a fresh search if no replacement is documented) before recommending the migration. Never silently keep an archived / abandoned package in the lockfile just because the bump compiles.
• Output Markdown only

Execution

1. Update Context

• Use output from composer update if available
• Otherwise compare current composer.lock with the previous version

2. Detect Updated Packages

• List all added or changed packages
• Include version changes: old → new

3. Conflict Detection

• Identify dependency conflicts from:
  • composer output
  • version constraint mismatches (composer.json vs composer.lock)
• Summarize conflicts clearly (package → reason)
• If none: state "No conflicts detected"

4. Changelog Extraction

For each updated package:

• Prefer:

  • vendor/<package>/CHANGELOG*

• Fallback:

  • repository releases (GitHub/GitLab)
  • package homepage

• Extract:

  • breaking changes
  • new features
  • important fixes

• If unavailable:

  • state "No changelog found"

5. Suggested Follow-up

• Recommend relevant checks:
  • run tests
  • composer validate
  • composer audit

Output Format

Use the template defined in templates/update-report.md.

Principles

• Focus on impactful changes, not noise
• Highlight breaking changes first
• Prefer local sources over remote
• Be concise and actionable
• Highlight security-related changes when present